Pith. sign in

REVIEW 3 major objections 5 minor 35 references

Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Standard MLP membership-inference attacks on differentially private location aggregates learn only a one-threshold sum rule, are suboptimal under Laplace noise, and therefore underestimate privacy risk.

desk verdict Empirical finding about MLP-based MIAs is credible and useful, but the DP-benchmark argument is shaky and the theorems have sign errors. read the letter →

arxiv 2412.20456 v1 pith:6LVC27QK submitted 2024-12-29 cs.CR

Yuhan Liu , Florent Guepin , Igor Shilov , Yves-Alexandre De Montjoye This is my paper · ORCID
classification cs.CR
keywords membershipinferenceattackdifferentialprivacylocationaggregatesmeta-classifiertwo-thresholdone-thresholdLaplacemechanismauditing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Membership inference audits are only as strong as the rule the attack model actually learns. This paper argues that the multi-layer perceptron (MLP) used as a meta-classifier in earlier membership inference studies on differentially private location aggregates learns only a sum-and-threshold rule: add up the noisy cells where the target trace is present and compare the total to one threshold. Under Laplace DP noise that rule is not the best one; the paper's two-threshold attack, which tests each positive cell separately and then counts how many cells pass, performs better, so the MLP's accuracy sits below the value DP theory predicts and the published privacy risk is an underestimate. The paper proves MLPs can encode the two-threshold rule and shows on real location data that they learn it only when trained on roughly 200,000 shadow aggregates instead of 2,000. If the argument is right, privacy audits on DP-protected multi-observation data should be built around mechanism-specific score rules rather than a generic classifier trained on a small shadow set.

What carries the argument

The central objects are two score functions and the MLP that is supposed to learn them. The one-threshold score $S_1(\tilde A,z)=\sum_{l,e}\mathbf{1}(z_{le}=1)\tilde A_{le}$ sums the noisy positive-observation cells; the two-threshold score $S_2(\tilde A,z)=\sum_{l,e}\mathbf{1}(z_{le}=1)\mathbf{1}(\tilde A_{le}\ge T_{le})$ runs a per-cell likelihood-ratio test and then thresholds the count of passing cells. The two-threshold rule does the argument's work because it is the better rule under Laplace noise and the rule the MLP fails to learn at 2,000 shadow aggregates; Theorem 5 shows an MLP with $n$ hidden sigmoid units can encode it, making the observed weight patterns interpretable as evidence that the model is stuck on the simpler sum rule.

What would settle it

A reader could test the claim by running the one-threshold, two-threshold, and MLP attacks on a second location dataset with different sparsity under Laplace noise: if the one-threshold attack or a regularised MLP matches or beats the two-threshold attack, the claimed superiority of the two-threshold rule would not generalise. A second, sharper check is to compute the exact Neyman-Pearson attack for the Laplace mechanism; if that optimal accuracy is clearly below the DP composition line, then part of the measured gap is bound looseness rather than MLP suboptimality.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the previous MLP-based meta-classifier attack is stuck at a local optimum: it learns the one-threshold rule $f(x)=\mathbf{1}(\sum_i x_i \ge T)$ regardless of the noise mechanism, even though the informed-attacker setting (where the adversary knows every non-target trace, matching DP's threat model) still shows a large gap between the attack's empirical accuracy and the expected accuracy derived from the DP composition bound. The paper introduces the two-threshold rule $f(x)=\mathbf{1}(\sum_i \mathbf{1}(x_i \ge T_i) \ge T)$, shows it beats the one-threshold rule under Laplace noise (while the one-threshold rule wins under Gaussian noise), and reports that an MLP trained with 2,000 shadow aggregates has weights matching the one-threshold pattern while one trained with 200,000 shadow aggregates matches the two-threshold pattern and reaches the same accuracy as the two-threshold attack. Theorems 4 and 5 establish that sigmoid MLPs can approximate both rules, so the suboptimality is a learning and data-scale problem, not an expressivity limit.

Load-bearing premise

The argument that standard MLP audits underestimate privacy risk depends on the two-threshold attack being close to optimal under Laplace noise; the paper shows this empirically on a single dataset, while the DP 'expected accuracy' used as the comparison target is an upper bound over all mechanisms with the same DP guarantee rather than the exact Laplace attack accuracy.

Editorial extensions

If this is right

  • Existing MIA results on Laplace-perturbed location aggregates obtained with the standard 2,000-shadow-aggregate MLP should be read as lower bounds on privacy risk: the paper's two-threshold attack achieves higher accuracy, and the MLP reaches it once given enough training data.
  • An auditor facing Laplace noise should use the two-threshold score rule, or train the MLP until its learned weights match that rule; under Gaussian noise the one-threshold rule is the better target.
  • MLP-based meta-attacks are expressive enough for the stronger rule, so their failure at small training scale is a data-hunger problem; the paper finds 200,000 shadow aggregates sufficient on its dataset.
  • The two-score logic carries over to other differentially private releases with several observations per individual, such as allele frequencies or per-record loss trajectories.
  • Synthetic data generation and pre-training are proposed as ways to give the MLP the large effective training set it needs when auxiliary data is scarce.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the 'expected attack accuracy' from DP theory is a composition bound over all mechanisms with the same DP guarantee, not the exact accuracy of the Laplace mechanism, so a gap between any concrete attack and that line does not by itself prove the attack is suboptimal; the case rests on the two-threshold rule being near-optimal for Laplace.
  • Beyond the paper: the dominance of the two-threshold rule under Laplace is demonstrated on one real dataset, so a natural check is to re-run the comparison on sparser or more correlated traces, where per-cell thresholds may need to be re-tuned or may fail to dominate.
  • Beyond the paper: the same 'threshold each heavy-tailed observation, then threshold the count' recipe could be tested against other heavy-tailed noise distributions, where error accumulation would likewise favour per-observation tests.
  • Beyond the paper: deriving the exact Neyman-Pearson attack accuracy for the Laplace mechanism would settle whether the residual gap after 200k training is real privacy risk or just looseness in the composition bound.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies membership inference attacks (MIAs) on location aggregates protected by differential privacy (DP). The authors observe a gap between the 'expected attack accuracy' computed from the Kairouz et al. optimal composition theorem and the empirical accuracy of MLP-based meta-classifier attacks, and interpret this as evidence that previous MLP attackers are sub-optimal and underestimate privacy risk. They propose two metric-based attacks, the one-threshold and two-threshold attacks, which formalize MIA as hypothesis testing with score functions. On the Milano dataset, the two-threshold attack outperforms the MLP attacker under Laplace noise, while the one-threshold attack is better under Gaussian noise. Through weight analyses and two theorems, they argue that the MLP trained with 2,000 shadow aggregates learns only the one-threshold rule, but with 200,000 shadow aggregates it can learn the two-threshold rule. The paper concludes that previous MLP-based audits under Laplace DP may underestimate privacy risk and discusses extensions to other multi-observation DP releases.

Significance. If the central claim is correct, the paper makes a practically important point: auditing tools based on meta-classifier attacks may produce optimistic privacy risk estimates for DP-protected multi-observation data, and the data-hungriness of MLP attackers can lead to local optima. The paper's strengths are its first-principles construction of the two metric attacks, clear algorithm pseudocode, evaluation with accuracy/AUC/ROC at small false positive rates, and the falsifiable prediction that an MLP can learn the two-threshold rule with enough shadow aggregates, which is tested empirically. However, the significance is currently tempered by two unresolved issues: the expected-accuracy benchmark is a worst-case DP composition bound rather than the exact attack accuracy for Laplace noise, and the theoretical constructions in Theorems 4 and 5 contain sign errors, so the capability proof is not yet valid as stated.

major comments (3)
  1. [Section 2.2.1, Figure 1] The 'expected attack accuracy given by DP theory' is derived from the optimal composition theorem of Kairouz et al. [1], which characterizes the worst-case tradeoff between type I and type II errors over all mechanisms satisfying the same (ε,δ)-DP guarantee, not the exact achievable accuracy of the specific Laplace mechanism used in the experiments. A gap between an empirical attack and this worst-case upper bound does not by itself demonstrate suboptimality of the MLP. Since the underestimation claim in the abstract and Section 1 is anchored to this gap, the paper should benchmark against the exact likelihood-ratio test for the Laplace mechanism (i.e., thresholding the sum of per-cell log-likelihood ratios) and report how far the DP bound is from that exact optimum. Without this, the observed gap could be explained by bound looseness rather than by MLP suboptimality.
  2. [Theorems 4 and 5] Theorem 4's construction has a sign error: with w^(1)_{n+1} = aT, the approximate step is centered at -T, not T; the correct bias is -aT. In Theorem 5, the construction is internally inconsistent: w^(2)_{j1} is assigned both b and bn/2, and the stated bias does not depend on the output threshold T, so the formula cannot approximate the step function in Eq. (13) for arbitrary T. These errors invalidate the proof that MLPs can encode the two-threshold rule as stated. Since this is the second main contribution of the paper, the constructions must be corrected and verified numerically.
  3. [Section 5 and Section 6] The empirical support for the central claims is limited to a single real-world dataset (Milano), yet the abstract and conclusion generalize to 'any differentially private datasets containing multiple observations per individual.' The claim that different data distributions require different attack strategies is demonstrated for two DP noise distributions on one location dataset, not for different underlying trace distributions. The paper should either add experiments with synthetic trace distributions (varying sparsity, correlation, heavy tails) or substantially temper the generalization claims.
minor comments (5)
  1. [Section 2.1.1] The notation uses e for both timestamps and sites; a trace is defined with rows for 'distinct site e ∈ E' and columns for 'timestamp e ∈ E', which should be s ∈ S and t ∈ E. This makes later equations hard to follow.
  2. [Section 3.2, Figure 7] The caption says 'for non-members' twice; the second occurrence should be 'for members'.
  3. [Section 2.3.1] The text says 'There are two main takeaways from Theorem 3' but the referenced item is Definition 3; please correct the cross-reference.
  4. [Appendix D] The first sentence says 'in terms of accuracy, AUC, and AOC'; AOC should be ROC.
  5. [Section 5.2] The description of the target trace setup is unclear: one trace is removed as target z, but then 50,000 test aggregates are generated by 'the same procedure' over the target dataset. Please specify whether z is fixed across all test aggregates and how the 7,896 target traces are used.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central comparison is against an external DP composition bound, and the metric-based attacks are defined from first principles with no fitted constants renamed as predictions.

full rationale

The paper's load-bearing claim is that MLP-based MIAs learn only a one-threshold rule and therefore underperform under Laplace noise. The evidence chain is not circular. The 'expected attack accuracy' in Figure 1 is taken from the external composition theorem of Kairouz et al. [1], not from the paper's own attacks or fitted values; the gap between that bound and the MLP's empirical accuracy is a direct measurement, and the comparison is to previously published MLP baselines [15, 6]. The one-threshold and two-threshold attacks are defined from first principles as score functions (Algorithms 2 and 4) and evaluated on held-out test aggregates after estimating thresholds on shadow aggregates, which is standard evaluation rather than fitting a parameter and calling it a prediction. The claim that the MLP learned only the one-threshold rule is supported by an independent inspection of the learned weight matrices (Figures 12, 15, 23, 24), compared with the constructive approximations in Theorems 4 and 5; no uniqueness theorem from the authors' prior work is invoked to force this conclusion. The principal weakness of the paper is interpretive, not circular: the Kairouz bound is a worst-case tradeoff over all mechanisms with a given DP guarantee, so the observed gap does not by itself prove that the MLP is suboptimal for the specific Laplace mechanism. That is a correctness and empirical-support concern, not a reduction of the result to its own inputs. Accordingly, no circular step meets the standard of being quotable and exhibiting Eq. X = Eq. Y by construction or a fitted parameter renamed as a prediction.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper's central comparison rests on standard CLT approximations, the assumption that shadow aggregates match the target distribution, and the midpoint threshold rule under symmetric score distributions. The 'expected accuracy' benchmark from DP composition is treated as exact without checking tightness. No new entities are postulated.

assumptions (5)
  • standard math The central limit theorem gives accurate Gaussian approximations for the one-threshold and two-threshold score distributions.
    Theorem 2 and the CLT variants in Section 3.3 use normal approximations for sums of per-cell observations; this requires a sufficiently large number of positive observations and independence across cells.
  • domain assumption The auxiliary dataset follows the same underlying trace distribution as the target dataset.
    Shadow aggregates are generated by sampling from DAUX (Section 3.1.1, Algorithm 1) and are assumed to have the same distribution as the target aggregate, which is required for threshold estimation and MLP training to transfer.
  • domain assumption The score distributions are symmetric, so the threshold that maximizes balanced accuracy is the midpoint of the two means.
    Algorithms 3 and 5 set T = (mu0 + mu1)/2 based on symmetry; if the distributions are skewed, this threshold is not accuracy-maximizing.
  • domain assumption The DP composition theorem provides the expected attack accuracy for the informed attacker.
    Used in Figure 1 and Section 2.3.2 to define the gap; it is an upper bound, not a mechanism-specific exact prediction, and the paper does not assess tightness.
  • standard math A sigmoid MLP with at least n hidden units can approximate per-cell step functions and their sum.
    Theorems 4 and 5 rely on this standard universal approximation capability, though the specific weight and bias constructions in the paper contain sign errors.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates." pith.science (2026). https://pith.science/paper/6LVC27QK

@misc{pith2026241220456,
  author       = {Pith},
  title        = {Pith review of: Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6LVC27QK}},
  note         = {Machine review of arXiv:2412.20456}
}
read the original abstract

The widespread collection and sharing of location data, even in aggregated form, raises major privacy concerns. Previous studies used meta-classifier-based membership inference attacks~(MIAs) with multi-layer perceptrons~(MLPs) to estimate privacy risks in location data, including when protected by differential privacy (DP). In this work, however, we show that a significant gap exists between the expected attack accuracy given by DP and the empirical attack accuracy even with informed attackers (also known as DP attackers), indicating a potential underestimation of the privacy risk. To explore the potential causes for the observed gap, we first propose two new metric-based MIAs: the one-threshold attack and the two-threshold attack. We evaluate their performances on real-world location data and find that different data distributions require different attack strategies for optimal performance: the one-threshold attack is more effective with Gaussian DP noise, while the two-threshold attack performs better with Laplace DP noise. Comparing their performance with one of the MLP-based attack models in previous works shows that the MLP only learns the one-threshold rule, leading to a suboptimal performance under the Laplace DP noise and an underestimation of the privacy risk. Second, we theoretically prove that MLPs can encode complex rules~(\eg, the two-threshold attack rule), which can be learned when given a substantial amount of training data. We conclude by discussing the implications of our findings in practice, including broader applications extending beyond location aggregates to any differentially private datasets containing multiple observations per individual and how techniques such as synthetic data generation and pre-training might enable MLP to learn more complex optimal rules.

Figures

Figures reproduced from arXiv: 2412.20456 by the authors.

Figure 1
Figure 1. Comparison between the expected accuracy and attack accuracy of the typical meta-classifier-based at [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An illustration of user traces and their aggregation. Figure [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The overall pipeline of MIAs with meta-classifier: infer the membership of the target [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (24 more)
Figure 4
Figure 4. Figure 4: The overall pipeline of the metric-based MIAs: infer the membership of the target [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: An illustration of two designed score functions for the one-threshold attack ( [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Illustration of the attack accuracy (i.e., probability of correct guessing p) with a varying number of positive observations for informed attacker (i.e., DP attacker). While Two-threshold (Binomial) stands for the precise result, Two-threshold (CLT) is the result after…
Figure 7
Figure 7. Figure 7: An example of data distribution at cell A˜r le for both informed attacker and auxiliary attacker. In particular, for the auxiliary attacker in [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: The corresponding one-threshold score distributions of 60 positive observations with the individual cell [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: An example of attack accuracy and the corresponding ROC with varying thresholds under informed attackers. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: The corresponding two-threshold score distribution over [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: Illustration of the MLP architecture considered in this work. [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]
Figure 12
Figure 12. Figure 12: The learned weights of the MLP-based attacker model with an architecture as shown in Figure [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Attack accuracy with an increasing number of positive observations under the Laplace mechanism. The [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]
Figure 14
Figure 14. Figure 14: Attack accuracy with an increasing number of positive observations under the Laplace mechanism. The [PITH_FULL_IMAGE:figures/full_fig_p019_14.png]
Figure 15
Figure 15. Figure 15: The learned weights of the MLP-based attacker model with an architecture as shown in Figure [PITH_FULL_IMAGE:figures/full_fig_p019_15.png]
Figure 16
Figure 16. Figure 16: The impact of value a and b in Theorem 4. In [PITH_FULL_IMAGE:figures/full_fig_p023_16.png]
Figure 17
Figure 17. Figure 17: Attack AUC with increasing number of positive observations under the Laplace mechanism. [PITH_FULL_IMAGE:figures/full_fig_p024_17.png]
Figure 18
Figure 18. Figure 18: Attack ROC with increasing number of positive observations under the Laplace mechanism. [PITH_FULL_IMAGE:figures/full_fig_p025_18.png]
Figure 19
Figure 19. Figure 19: Attack accuracy with increasing number of positive observations under the Gaussian mechanism. [PITH_FULL_IMAGE:figures/full_fig_p026_19.png]
Figure 20
Figure 20. Figure 20: Attack AUC with increasing number of positive observations under the Gaussian mechanism. [PITH_FULL_IMAGE:figures/full_fig_p027_20.png]
Figure 21
Figure 21. Figure 21: Attack ROC with increasing number of positive observations under the Gaussian mechanism. [PITH_FULL_IMAGE:figures/full_fig_p028_21.png]
Figure 22
Figure 22. Figure 22: Attack performance with varying training shadow aggregates and [PITH_FULL_IMAGE:figures/full_fig_p029_22.png]
Figure 23
Figure 23. Figure 23: The learned weights of the MLP-based attacker model with an architecture as shown in Figure [PITH_FULL_IMAGE:figures/full_fig_p029_23.png]
Figure 24
Figure 24. Figure 24: The learned weights of the MLP-based attacker model with an architecture as shown in Figure [PITH_FULL_IMAGE:figures/full_fig_p030_24.png]
Figure 25
Figure 25. Figure 25: The learned weights of the MLP-based attacker model with [PITH_FULL_IMAGE:figures/full_fig_p030_25.png]
Figure 26
Figure 26. Figure 26: The learned weights of the MLP-based attacker model with [PITH_FULL_IMAGE:figures/full_fig_p030_26.png]
Figure 27
Figure 27. Figure 27: Attack ROC 60 positive observations under the Laplace mechanism. The meta-classifier-based attack model is an MLP model with 100 nodes in one hidden layer. 31 [PITH_FULL_IMAGE:figures/full_fig_p031_27.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 23 canonical work pages

  1. [1]

    The composition theorem for differential privacy,

    P. Kairouz, S. Oh, and P. Viswanath, “The composition theorem for differential privacy,” inInternational confer- ence on machine learning. PMLR, 2015, pp. 1376–1385

    work page 2015

  2. [2]

    Large-scale spatial-transmission models of infectious disease,

    S. Riley, “Large-scale spatial-transmission models of infectious disease,” Science, vol. 316, no. 5829, pp. 1298– 1301, 2007

    work page 2007

  3. [3]

    How spatial epidemiology helps understand infectious human disease transmission,

    C.-H. Lin and T.-H. Wen, “How spatial epidemiology helps understand infectious human disease transmission,” Tropical Medicine and Infectious Disease, vol. 7, no. 8, p. 164, 2022

    work page 2022

  4. [4]

    Urban planning and building smart cities based on the internet of things using big data analytics,

    M. M. Rathore, A. Ahmad, A. Paul, and S. Rho, “Urban planning and building smart cities based on the internet of things using big data analytics,” Computer networks, vol. 101, pp. 63–80, 2016

    work page 2016

  5. [5]

    Protecting locations with differential privacy under temporal correlations,

    Y . Xiao and L. Xiong, “Protecting locations with differential privacy under temporal correlations,” inProceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1298–1309

    work page 2015

  6. [6]

    A zero auxiliary knowledge membership inference attack on aggregate location data,

    V . Guan, F. Gu´epin, A.-M. Cretu, and Y .-A. de Montjoye, “A zero auxiliary knowledge membership inference attack on aggregate location data,” Proceedings on Privacy Enhancing Technologies, 2024

    work page 2024

  7. [7]

    Differential privacy,

    C. Dwork, “Differential privacy,” in International colloquium on automata, languages, and programming . Springer, 2006, pp. 1–12

    2006

  8. [8]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Roth et al., “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

    2014

Show all 35 references
  1. [9]

    Optimal noise-adding mechanism in additive differential privacy,

    Q. Geng, W. Ding, R. Guo, and S. Kumar, “Optimal noise-adding mechanism in additive differential privacy,” in The 22nd International Conference on Artificial Intelligence and Statistics. PMLR, 2019, pp. 11–20

    2019

  2. [10]

    Unleash the power of ellipsis: Accuracy-enhanced sparse vector technique with exponential noise,

    Y . Liu, S. Wang, Y . Liu, F. Li, and H. Chen, “Unleash the power of ellipsis: Accuracy-enhanced sparse vector technique with exponential noise,” arXiv preprint arXiv:2407.20068, 2024

    2024 arXiv

  3. [11]

    R ´enyi differential privacy,

    I. Mironov, “R ´enyi differential privacy,” in 2017 IEEE 30th computer security foundations symposium (CSF) . IEEE, 2017, pp. 263–275

    2017

  4. [12]

    Gaussian differential privacy,

    J. Dong, A. Roth, and W. J. Su, “Gaussian differential privacy,”Journal of the Royal Statistical Society: Series B (Statistical Methodology), vol. 84, no. 1, pp. 3–37, 2022

    2022

  5. [13]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 1897–1914

    2022

  6. [14]

    Enhanced membership inference attacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 3093–3106

    2022

  7. [15]

    Knock knock, who’s there? membership inference on aggregate location data,

    A. Pyrgelis, C. Troncoso, and E. De Cristofaro, “Knock knock, who’s there? membership inference on aggregate location data,” 2018

    2018

  8. [16]

    Likelihood ratio tests, neyman-pearson detectors, roc curves, and sufficient statistics,

    “Likelihood ratio tests, neyman-pearson detectors, roc curves, and sufficient statistics,” https://cpb-us-w2. wpmucdn.com/voices.uchicago.edu/dist/9/1193/files/2016/02/03-LRT ErrorTradeoffs NP.pdf, accessed: 2024- 10-15

    2016

  9. [17]

    Learning poisson binomial distributions,

    C. Daskalakis, I. Diakonikolas, and R. A. Servedio, “Learning poisson binomial distributions,” in Proceedings of the forty-fourth annual ACM symposium on Theory of computing, 2012, pp. 709–728

    2012

  10. [18]

    Robust traceability from trace amounts,

    C. Dwork, A. Smith, T. Steinke, J. Ullman, and S. Vadhan, “Robust traceability from trace amounts,” in 2015 IEEE 56th Annual Symposium on Foundations of Computer Science. IEEE, 2015, pp. 650–669

    2015

  11. [19]

    A multi-source dataset of urban life in the city of milan and the province of trentino,

    G. Barlacchi, M. De Nadai, R. Larcher, A. Casella, C. Chitic, G. Torrisi, F. Antonelli, A. Vespignani, A. Pentland, and B. Lepri, “A multi-source dataset of urban life in the city of milan and the province of trentino,” Scientific data, vol. 2, no. 1, pp. 1–15, 2015

    2015

  12. [20]

    Social Pulse - Milano,

    SpazioDati and D. P. di Milano, “Social Pulse - Milano,” 2015. [Online]. Available: https://doi.org/10.7910/ DVN/9IZALB

    2015

  13. [21]

    Collecting triangle counts with edge relationship local differential privacy,

    Y . Liu, S. Zhao, Y . Liu, D. Zhao, H. Chen, and C. Li, “Collecting triangle counts with edge relationship local differential privacy,” in2022 IEEE 38th International Conference on Data Engineering (ICDE) . IEEE, 2022, pp. 2008–2020. 21 Sub-optimal Learning in Meta-Classifier ...

    2022

  14. [22]

    Edge-protected triangle count estimation under relationship local differential privacy,

    Y . Liu, T. Wang, Y . Liu, H. Chen, and C. Li, “Edge-protected triangle count estimation under relationship local differential privacy,”IEEE Transactions on Knowledge and Data Engineering, 2024

    2024

  15. [23]

    Membership inference attacks by exploiting loss trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership inference attacks by exploiting loss trajectory,” 2022. [Online]. Available: https://arxiv.org/abs/2208.14933

    2022 arXiv

  16. [24]

    Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays,

    N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V . Pearson, D. A. Stephan, S. F. Nelson, and D. W. Craig, “Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays,” PLoS genetics,...

    2008

  17. [25]

    Measuring membership privacy on aggregate location time-series,

    A. Pyrgelis, C. Troncoso, and E. D. Cristofaro, “Measuring membership privacy on aggregate location time-series,” 2020. [Online]. Available: https://arxiv.org/abs/1902.07456

    2020 arXiv

  18. [26]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18

    2017

  19. [27]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF). IEEE, 2018, pp. 268–282

    2018

  20. [28]

    Low-cost high-power membership inference attacks,

    S. Zarifzadeh, P. Liu, and R. Shokri, “Low-cost high-power membership inference attacks,” in Forty-first Inter- national Conference on Machine Learning, 2024

    2024

  21. [29]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” arXiv preprint arXiv:1806.01246 , 2018

    2018 arXiv

  22. [30]

    A pragmatic ap- proach to membership inferences on machine learning models,

    Y . Long, L. Wang, D. Bu, V . Bindschaedler, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “A pragmatic ap- proach to membership inferences on machine learning models,” in2020 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2020, pp. 521–534

    2020

  23. [31]

    On the privacy risks of model explanations,

    R. Shokri, M. Strobel, and Y . Zick, “On the privacy risks of model explanations,” in Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society, 2021, pp. 231–241

    2021

  24. [32]

    Stealing links from graph neural networks,

    X. He, J. Jia, M. Backes, N. Z. Gong, and Y . Zhang, “Stealing links from graph neural networks,” in30th USENIX security symposium (USENIX security 21), 2021, pp. 2669–2686

    2021

  25. [33]

    Inference attacks against graph neural networks,

    Z. Zhang, M. Chen, M. Backes, Y . Shen, and Y . Zhang, “Inference attacks against graph neural networks,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 4543–4560

    2022

  26. [34]

    Link stealing attacks against inductive graph neural networks,

    Y . Wu, X. He, P. Berrang, M. Humbert, M. Backes, N. Z. Gong, and Y . Zhang, “Link stealing attacks against inductive graph neural networks,” arXiv preprint arXiv:2405.05784, 2024

    2024 arXiv

  27. [35]

    Systematic evaluation of privacy risks of machine learning models,

    L. Song and P. Mittal, “Systematic evaluation of privacy risks of machine learning models,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2615–2632. A Threshold Estimation with Fixed Error Algorithm 6: ThresholdEstimation. Estimate the threshold T for the o...

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.